Researchers have taken apart TASK#STOMP, a Windows backdoor that searches a victim’s drives for business documents, uploads them to attacker servers, and then stays put to grab each new or edited document. The same malware steals saved Wi-Fi passwords and clipboard text, takes screenshots, and runs whatever command its operators send.
Akshay Gaikwad and Aaron Beardslee of Securonix Threat Research built their analysis from one infected machine, so Securonix cannot say how many organizations are affected. The malware plants at least five footholds, four scheduled tasks and a copy of itself in the Startup folder, and researchers warn that removing only one may leave the others able to rebuild the infection.
TASK#STOMP process flow reconstructed from observed process telemetry (Source: Securonix)
Five ways back in
The infection starts with a VBScript file, a Windows script, sitting on the user’s desktop. The script creates four scheduled tasks with names that imitate Windows components, such as “Network Audio Service,” and copies itself into the Startup folder so it runs again when the user signs in. Its files sit in a folder called WinDefendSvc, named to resemble a Windows Defender service.
Deleting the script from the desktop does nothing to the copy in the Startup folder.
Two hidden PowerShell modules handle the theft. One hunts for documents, the other keeps a second channel open to the operators. Each is coded to restart its partner if it stops, though Securonix found the same bug in both that leaves part of that watchdog logic largely unreachable.
No name on the attacker yet
Beardslee, manager of threat research at Securonix, said “nothing in the sample’s code, infrastructure, or TTPs overlaps cleanly with a known APT’s established toolkit, so we’re not making an attribution claim.”
The malware works through file types in a set order. “What we can say: the document-type priority (Word → PDF → PowerPoint → Excel, ahead of archives) points to corporate-document espionage rather than opportunistic crimeware,” he told Help Net Security.
The script also opens a web page in Chrome. “The ‘IranTenders’-themed domain the malware opens is consistent with a procurement/tender-themed lure, which suggests the operators may be targeting organizations that deal with tenders, contracts, or Iran-related trade/procurement — but a single decoy domain isn’t enough to confirm sector or regional targeting on its own,” Beardslee said. Securonix does not treat the IranTenders site itself as malicious, and it warns against blocking the whole domain without more evidence. Its advisory lists the command-server domains, the authentication token and file hashes. Organizations can search their network logs for the domains, their endpoint security tools for the hashes, and, if they inspect encrypted web traffic, their proxy logs for the token.
How long it has run
Asked how long the campaign has been active, Beardslee told us that “the malware backdates several of its own files to January 15, 2024 as an anti-forensic technique — that date is fabricated by the attacker to mislead file-timeline review, not evidence of when the real campaign began, and we’d caution against anyone using it to infer a timeline.” Beardslee said Securonix would need data from outside this one machine to date the campaign, such as registration and DNS history for the two command-server domains, or access to other infected machines.
Stopping the script before it runs
“We couldn’t confirm the delivery vector directly from what was recovered,” Beardslee said. His best estimate: “Based on how comparable VBS-loader campaigns are typically delivered, the most likely pattern is a phishing email carrying a ZIP or ISO/IMG attachment containing the script.”
He recommends blocking or alerting when Windows Script Host runs files from the Desktop, Downloads, or Temp folders, restricting Windows Script Host for standard users or allowing only signed scripts, and stripping, sandboxing, or blocking ISO, IMG, and VBS attachments at the mail gateway.
Reused code leaves a trail
“It points to a competent-but-not-elite operator,” Beardslee said. He called the malware’s design fairly sophisticated, pointing to features such as two modules that watch over each other and automatic switching to a backup server. But the two modules contain nearly identical code for skipping security-certificate checks, and both carry the same bug, which he said is a strong sign the code was copied and pasted rather than built and tested separately. “That profile — capable tooling built on a reused or templated codebase, without rigorous internal review — is more typical of a mid-tier operator than a mature, disciplined APT,” he said.
“The static, hardcoded authentication token is a durable, high-confidence network indicator — any traffic carrying that exact token value to any domain is worth flagging, and because it isn’t rotated per victim, it could help cluster future incidents back to the same operator or infrastructure if it reappears,” he said.
Researchers advise responders to save copies of the malware’s files and scheduled-task definitions for analysis before touching anything. Next, stop the running scripts. Then remove every scheduled task the malware created, the Startup copy, and the staged files in one coordinated pass, and block the two command servers. After a reboot, check that none of the malware’s scripts start running again.
eBook: Identity-First Threat Intelligence
